Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering why it is so. All links (I've found) concerning the size of the file state that the size is about the same as the size of physical RAM, or the size processor can address. I'm on 32bit.

I sometimes use kcore when I need to string the RAM to look for deleted text.

/proc/kcore: 1.1GB

RAM: 2.6 GB

~ $ ll /proc/kcore
-r-------- 1 root root 1065349120 2011-12-05 09:42 /proc/kcore
~ $ sudo dd if=/proc/kcore of=/dev/null bs=1024
1040380+0 records in
1040380+0 records out
1065349120 bytes (1.1 GB) copied, 2.26191 s, 471 MB/s

~ $ free -m
             total       used       free     shared    buffers     cached
Mem:          2509       1742        766          0        132       1118
-/+ buffers/cache:        492       2016
Swap:         1051          0       1051

~ $ grep ^Mem /proc/meminfo
MemTotal:        2569640 kB
MemFree:          791548 kB

~ $ dmesg | grep Memory
[    0.000000] Memory: 2554056k/2612412k available (4940k kernel code, 57908k reserved, 2333k data, 688k init, 1703108k highmem)

~ $ sudo lspci -v -s 00:02.0
00:02.0 VGA compatible controller: Intel Corporation 82915G/GV/910GL Integrated Graphics Controller (rev 04) (prog-if 00 [VGA controller])
    Subsystem: Intel Corporation Device 4556
    Flags: bus master, fast devsel, latency 0, IRQ 16
    Memory at ffa00000 (32-bit, non-prefetchable) [size=512K]
    I/O ports at ec00 [size=8]
    Memory at c0000000 (32-bit, prefetchable) [size=256M]
    Memory at ffa80000 (32-bit, non-prefetchable) [size=256K]
    Expansion ROM at <unassigned> [disabled]
    Capabilities: [d0] Power Management version 2
    Kernel driver in use: i915
    Kernel modules: i915

The full output of dmesg and lspci on Ubuntu pastebin.

Does anybody know why it is so

or - is anybody seeing the same behaviour (size(kcore) < size(RAM))?

share|improve this question

closed as too localized by James, jokerdino, Marco Ceppi Jan 25 '12 at 22:19

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

Are you using an integrated graphics card? Can you tell us more information about your hardware? – Bruno Pereira Dec 5 '11 at 9:17
@BrunoPereira: Yes, I am, I added lspci output, but the card uses too little memory to account for the difference I think. – arrange Dec 5 '11 at 9:28
true true true, sorry was to fast jumping to conclusions. I see that 1051MB are reserved for swap, are you using RAM for swap? Did you install any swap to ram utilities? – Bruno Pereira Dec 5 '11 at 10:01
@BrunoPereira: No, it's a classic swap partition, and it's almost never used as 2.5GiB is plenty of RAM for my use. Also, when I grep the contents of kcore I can see it is actually mapping my RAM, but only 1GB of it... – arrange Dec 5 '11 at 10:06
This question appears to be abandoned, if you are experiencing a similar issue please ask a new question with details pertaining to your problem. If you feel this question is not abandoned, please flag the question explaining that. :) – James Jan 25 '12 at 2:08

I am seeing the same behaviour on my system:

free -m
             total       used       free     shared    buffers     cached
Mem:          2011       1877        133          0        128        685
-/+ buffers/cache:       1063        947
Swap:         2099          1       2098

ll /proc/kcore 
-r-------- 1 root root 1016M 2011-12-06 01:09 /proc/kcore

Ok, I am not so sure about that but this could be related with HIGHMEM/LOWMEM issue on 32bit systems.

Look at this:

dmesg | grep MEM
[    0.000000] 1158MB HIGHMEM available.
[    0.000000] 887MB LOWMEM available.

via linux-mm

Why highmem

Currently the 32 bit x86 architecture is the most popular type of computer. In this architecture, traditionally the Linux kernel has split the 4GB of virtual memory address space into 3GB for user programs and 1GB for the kernel.


Coping with highmem

However, many people insist on using more than 1GB of physical memory on such a 32 bit system. This makes it necessary for the Linux kernel to jump through some interesting hoops...

Basically the system uses the following tactics:

Memory above the physical address of 896MB are temporarily mapped into kernel virtual memory whenever the kernel needs to access that memory.

Data which the kernel frequently needs to access is allocated in the lower 896MB of memory (ZONE_NORMAL) and can be immediately accessed by the kernel (see Temporary mapping).


So, I think we only see kernel reserved memory space with /proc/kcore. By the way, I am using an 32bit Ubuntu version, too.

share|improve this answer
Hi, thanks for the answer. So you think kcore maps the HIGHMEM or LOWMEM? In my case dmesg reports 1663MB HIGHMEM and 887MB LOWMEM. – arrange Dec 6 '11 at 7:40
I thought it was HIGHMEM for 32bit systems since this suits for my outputs but for you this is not so. /proc/kcore definition in man proc is no so up-to-date I think. – heartsmagic Dec 6 '11 at 16:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.